1 files changed, 22 insertions, 6 deletions
diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 935777f..0902830 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -149,12 +149,28 @@ int gsp_phys_boot_rm_unload(void __iomem *bar0);
  *     work-submit token (function 76); stage 4 schedules the channel, writes
  *     the CE method block plus GPFIFO entry and USERD GP_PUT, rings the PF
  *     channel doorbell and polls the sysmem semaphore for a real 4 KB
- *     sysmem-to-sysmem copy (function 76 + the CE doorbell path). Serialised
- *     with the other triggers by gsp_phys_rm_lock, per-RPC bounded
- *     (2000 ms), aborts at the first failure with no object teardown (UNLOAD
- *     + rmmod is the fail-safe), never touches WPR2, and is inert until the
- *     file is written. Ladder buffers are freed by
- *     gsp_phys_boot_staging_free() on release.
+ *     sysmem-to-sysmem copy (function 76 + the CE doorbell path). Writing 5
+ *     is the alternative stage-1 path: it adopts the
+ *     hInternalClient/hInternalDevice/hInternalSubdevice handles from the
+ *     session's decoded GspStaticConfigInfo (running the fn1+fn65 probe cycle
+ *     inline first when needed), marks stage 1 satisfied, and a following
+ *     write of 4 runs stages 2-4 against the adopted handles. On a failed
+ *     reply (rpc_result != 0, e.g. the fn103 NV01_ROOT rejection) the RPC
+ *     helper logs the payload words at +0/+16/+32 and the first 64 payload
+ *     bytes in bounded hex. Serialised with the other triggers by
+ *     gsp_phys_rm_lock, per-RPC bounded (2000 ms), aborts at the first
+ *     failure with no object teardown (UNLOAD + rmmod is the fail-safe),
+ *     never touches WPR2, and is inert until the file is written. Ladder
+ *     buffers are freed by gsp_phys_boot_staging_free() on release.
+ *   - "gsp-phys-log-dump" (read-only, mode 0444): dumps the LOGINIT and
+ *     LOGRM libos task-log host buffers allocated at stage-3d prime. Per
+ *     buffer: a one-line header (name, allocated size, kernel VA, DMA
+ *     address), the raw content as "%08x: %08x ..." hex lines (bounded to
+ *     the allocated size and 64 KB per buffer; authoritative for offline
+ *     decoding with the evidence tree's decode_logs.py) and a decoded view
+ *     derived from the known libos record format (word[0]=put pointer,
+ *     records {args..., metadata_ptr, timestamp}, last <=60 timestamp-like
+ *     records). Read-only: no buffer byte is modified.
  *   - "gsp-phys-state" (read-only, mode 0444): seq_file snapshot of the
  *     claimed/booted state (falcon registers, scratch14, both queue TX
  *     headers, a bounded read-only status-ring walk, the stage flags and the